Cybersecurity

Legislators on Capitol Hill have formed the Cyberspace Solarium Commission, known as the CSC, which will put together a comprehensive U.S. cyber policy. Sen. Angus King (I-Maine), who is co-chairing the new organization with Rep. Michael Gallagher (R-Wisc.), announced the formation of the Geneva Convention-type commission in a call with reporters on May 13. The establishment of the commission was outlined in last year’s National Defense Authorization Act (NDAA), Sen. King said.

Thirty years after the Morris Worm, networks face a long and growing list of potential attack vectors employed by an almost limitless number of threat sources, including criminals, hacktivists and nation-state actors. In response to threats, the U.S. Defense Department has taken prudent measures to shore up vulnerable systems and networks. In accordance with the well-established practice of concentric rings of security, the most sensitive department data exists on its most secure and isolated networks.

The National Security Agency is now sharing the source code of Ghidra, its reverse engineering tool developed by the agency’s Research Directorate in support of its cybersecurity mission. Ghidra, a suite of software analysis tools, examines complied code using capabilities such as disassembly, assembly, decompilation, graphing and scripting.

Ghidra helps analyze malicious code and malware and improves cybersecurity professionals’ understanding of potential vulnerabilities in their networks and systems. With this release, developers can now collaborate, create patches and extend the tool to fit their cybersecurity needs.

The water and wastewater treatment industry is facing cybersecurity threats. The risks affect the sector disproportionately compared to other utilities, given local-level water processing operations.

Along with physically securing its critical infrastructure, the water industry has to leverage available tools to protect against cyber attacks, an expert says.

In today’s environment, the network no longer can be considered a safe zone. Every asset an organization possesses and every transaction it conducts must be secured as if it were a standalone item continually exposed to the full range of cyber threats. The realization that perimeter protection alone is not sufficient has led to the security concept of Zero Trust. In this never-trust/always-verify approach, all entities and transactions rely on multiple solutions to work together and secure digital assets.

A prototype U.S. Navy program is turning to blockchain technology to help track aviation parts throughout their life cycles. The approach automates what is now a mostly manual process and provides aircraft maintenance personnel with accurate, detailed information about each part’s origins and order/reorder status.

The major challenges faced by federal agencies and DoD components in managing their cybersecurity and other risks include personnel shortages, daunting compliance requirements and the need for consistent data reporting and management across multiple elements of a diverse and geographically dispersed enterprise.

The RSA Archer Suite helps by automating the drudge work, providing context for incident reports, and other data flows and ensuring a common taxonomy, workflow and metrics across the enterprise. RSA Archer leaves human security personnel free to look at the bigger picture—and make decisions based on real-time, accurate information, intuitively displayed.

The focus of the second annual Cyber Education, Research and Training Symposium (CERTS) is national cyber policy and cyber workforce training. During his keynote address, Brig, Gen. Dennis A Crall, USMC, principal deputy cyber advisor, Office of the Secretary of Defense, stated, “Education and training is assembled for one reason and one reason only, and that’s warfighting."

“Everything we do is based on mission threats,” Gen. Crall added. “We are a mission-oriented group. When we talk about technology, people, training and education ...we don’t do cyber for cyber, we don’t educate for education's sake, we do that for the warfighting mission that we can accomplish.”

Work is needed to improve temporal, spectral and information understanding within the layers of the cyber domain to facilitate useful cyber-spectral and information maneuver. These advances could be incorporated into tactics, techniques and procedures as well as tactical and operational systems to enhance the overall military commanders’ decision process to achieve information dominance.

Most of the tactical cyberspace domain is spectrum-dependent and administered solely at the physical layer. Currently, warfighters cannot comprehend, much less maneuver within, a space that is inaccessible to them because they are not in a dimensionality to understand it. They operate in a cyber-spectral flatland.